Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1090210" data-attributes="member: 32260">One could ask a question: Why do the attackers bother to use scripting to install malware? They could use a password-protected archive (.zip, rar, etc.) or disk images (.iso, .img, etc.) to deliver the same malware.The difference is due to the Windows SmartScreen. When the malware is downloaded via scripting, it does not have the Mark of the Web (MotW), so SmartScreen for Explorer is not triggered on malware execution.If the attackers use an archive or disk image (a popular method two years ago), the SmartScreen is triggered on malware execution. Last year, Microsoft extended MotW propagation for disk images. Also, many archiver applications currently propagate MotW to the unpacked content.Having in mind the effort put by attackers into avoiding SmartScreen, it must still be a very efficient protection, that can be used with any AV.A similar note is true for Smart App Control (SAC). The scripting method from the article (no .ps1 file scripts) combined with script payload (.hta, .vbs, etc.) can bypass SAC as well.</blockquote>

[QUOTE="Andy Ful, post: 1090210, member: 32260"] One could ask a question: Why do the attackers bother to use scripting to install malware? They could use a password-protected archive (.zip, rar, etc.) or disk images (.iso, .img, etc.) to deliver the same malware. [B]The difference is due to the Windows SmartScreen. [/B]When the malware is downloaded via scripting, it does not have the Mark of the Web (MotW), so SmartScreen for Explorer is not triggered on malware execution. If the attackers use an archive or disk image (a popular method two years ago), the SmartScreen is triggered on malware execution. Last year, Microsoft extended MotW propagation for disk images. Also, many archiver applications currently propagate MotW to the unpacked content. Having in mind the effort put by attackers into avoiding SmartScreen, it must still be a very efficient protection, that can be used with any AV. A similar note is true for Smart App Control (SAC). The scripting method from the article (no .ps1 file scripts) combined with script payload (.hta, .vbs, etc.) can bypass SAC as well. [/QUOTE]

Verification